8 commits

Author	SHA1	Message	Date
Arena Agent	12f59109d7	revert(nigig-site): ce9e12b was wrong — the HTTP wire field is body, not text ... Commits dfffe9e + 13ae501 landed nigig-lite/crates/common (package `nigig-common`) and a vendored xitca-web into this repository, which makes the /sync wire format readable for the first time. Reading it shows ce9e12b was incorrect. There are TWO MessageContent types, deliberately: - nigig_common::MessageContent::Text { body, formatted_body, mentions } — the HTTP/JSON REST DTO. Its own doc-comment: "Serialises externally tagged, e.g. {"Text":{"body":"hi",…}}". This is what SendMessageRequest.content and TimelineEvent::Message.content are. - nimanyatta_protocol::MessageContent::Text { text } — the WebSocket chat protocol, serialized with postcard. nigig-common's manifest says that format "must match nimanyatta/crates/nimanyatta-protocol (the client library)". ce9e12b changed the E2E test's outgoing posts from {"Text":{"body":…}} to {"Text":{"text":…}}, reasoning from the WebSocket type. The original `body` was correct for these HTTP endpoints; my change would have made both requests fail deserialization. Reverted, and the now-unused nimanyatta-protocol dev-dependency is dropped from nigig-site. What ce9e12b got right is kept: the parser had keyed on "type":"message", but TimelineEvent carries no serde tag attribute, so it is externally tagged — {"Message":{…,"sender":…,"content":…}} with sender and content at the variant level. event_text still accepts that envelope (plus the legacy lowercase shape and `text` as last-resort field names). The fixture's cross-check test was rebuilt against nigig_common's real shape instead of the WebSocket type. It is NOT verified by execution: nigig-site's test target pulls in makepad-widgets, which is SIGKILLed on this host. The parser was verified instead by extracting event_text/sync_timelines verbatim into a standalone harness over four cases — nigig_common Message with `body` -> Some(("alice","slab done")); Membership -> None; Redaction -> None; legacy lowercase -> Some(("bob","old")). All pass. The harness is scratch, not shipped. EXECUTION_PLAN.md SITE-12 rewritten: the sibling repos are no longer missing, the /sync DTOs are named with their file paths, both MessageContent types are distinguished, and the narrower remaining blockers are stated — nimanyatta still cannot be a workspace member (xitca-web/web/Cargo.toml inherits rust-version and lints from a workspace root, and nested here it resolves to ours, which defines neither), and a full `cargo check --features b_server` has not completed on this host, so no build claim is made. Verified: cargo test -p nimanyatta-protocol = 14; cargo test -p nigig-site-core = 228 / 1 ignored; clippy -D warnings clean; cargo fmt --check clean; cargo metadata exit 0.	2026-09-26 17:39:20 +00:00
Arena Agent	ac40ac923f	fix(nigig-site): read the timeline field the protocol crate actually emits ... Pinning nimanyatta-protocol's JSON shape exposed a live bug in the E2E fixture, and answering "is nigig_common in this repo?" narrowed the SITE-12 gap. The bug: MessageContent::Text serializes as {"Text":{"text":"..."}}. tests/support/nimanyatta_fixture.rs::event_text only looked for content.Text.body — a field that type never emits, and which serde_json::from_str::<MessageContent> actively rejects. Against a real server every message would have been skipped, sync_timelines would return an empty vec, and live_round_trip would still have passed. A silently vacuous interop test is exactly the failure mode SITE-00 exists to prevent. - event_text now tries `text` first and keeps `body` as a fallback. - New test in nimanyatta-protocol pins the serialized shape and asserts the fixture's old guess does not decode. - New cross-check test in the fixture builds its payload from the real MessageContent type, so parser and protocol cannot diverge silently again. What was verified and what was not: - The protocol-crate tests run: 14 passed. - The fixture cross-check test COULD NOT be compiled or run here. nigig-site's test target pulls in makepad-widgets, which is SIGKILLed on this 2 vCPU / 1.9 GiB host. The parser change was instead verified by extracting event_text/sync_timelines verbatim from the fixture into a standalone harness: {"Text":{"text":"slab done"}} -> Some(("alice","slab done")), the legacy {"Text":{"body":...}} shape still falls back, and a non-message event returns None. That harness is not part of the shipped tree; the shipped cross-check test is unverified until CI runs it. Also recorded in EXECUTION_PLAN.md SITE-12: nigig_common is confirmed absent from this repository (no package by that name; RoomEvent/RoomInfo/ JoinedRoomSync/SyncFilter/PaginationDirection defined nowhere here; nigig-core is an email/IMAP crate), and it re-exports nimanyatta-protocol via a `protocol` module — the server writes nigig_common::protocol::{ClientToServerMsg, ServerToClientMsg}. So of the 75 items the server imports from nigig_common, 9 are the crate already pinned here; the remaining 66 are the HTTP DTO layer, ~11 of which /sync needs. Verified: cargo test -p nimanyatta-protocol = 14 passed; cargo test -p nigig-site-core = 228 passed / 1 ignored; clippy -D warnings clean; cargo fmt --check clean; cargo metadata exit 0; all 6 workflow python gates.	2026-09-26 12:37:08 +00:00
andodeki	0819e97074	feat(nigig-site): compile and test the hardening core; add SITE-20..28 domain ... Thirteen hardening modules (3,079 lines) sat in nigig-site/src/ declared in no mod statement. They had never been compiled or tested: cargo check never saw them, and the plan's "implemented in the worktree and pending verification" status was unverifiable by construction. Extract the UI-free core into crates/apps/nigig-site-core (scope 5's "Rust core crate ... testable; safe"; plan 6's target architecture). nigig-site depends on it and re-exports it, so there is one copy of each module source: the app and the core's unit tests compile the same files. The core has no Makepad dependency, so its contracts run on a memory-limited runner. Compiling that code for the first time found four real defects, all fixed: - Role/Capability lacked Ord, so every BTreeSet of them failed to compile (auth.rs) - CaptureResult::empty never initialised site_id from its site parameter (ocr_policy.rs) - negotiate_version(2, 5) agreed on a protocol the peer never offered, which is the silent downgrade the function exists to prevent (sync_protocol.rs) - an absurd frame size returned Overflow instead of the actionable budget breach (media_bounds.rs) New feature-tranche domain modules, each with unit tests: - organisation.rs SITE-20 invites, per-site roles, the 4.2 matrix as testable data, site registry with geofence, settings - report_pack.rs SITE-21 report numbering, entry status, signatures binding actor/device/timestamp/document hash, lock and versioning, multi-site compilation, monthly packs - site_diary.rs SITE-22 weather with provenance, plant, deliveries, delay log where a weather delay needs supporting rainfall, visitors, manpower by trade - workforce.rs SITE-23 consent-gated registration, tag-only blocklist, attendance with overtime, QR badges, payroll CSV that never emits identity, offboarding tombstones - programme.rs SITE-25 dependencies with cycle detection and rollback, topological order, critical path, frozen baselines with slippage, checklists gating approval, snags, RFIs, variations needing two distinct approvers - hse.rs SITE-28 append-only incidents, closure requires corrective action, toolbox talks, inspections, monthly statistics workflows.rs gains the FR-1.14 Locked state; commands.rs gains a bounded non-empty text validator shared by the new modules. CI: the SITE-02 crypto/repository/store lanes pointed at -p nigig-site, where those suites no longer live; left alone they would have compiled nothing and reported a vacuous green. Repointed at the core, and added core-contracts and core-clippy lanes with a ">=100 tests collected" check so a lane cannot pass vacuously. All six existing Python contract gates still pass. Auto-purge of worker ID data refuses to run until the scope 18 retention question is answered rather than inventing a window. Verified 2026-09-26: cargo test -p nigig-site-core --locked = 175 passed, 0 failed, 1 ignored (needs a live Secret Service session); cargo clippy -p nigig-site-core --all-targets --no-deps -- -D warnings clean; cargo check -p nigig-site clean. cargo test -p nigig-site is still killed by SIGKILL compiling makepad-widgets on a 2 GB host, as recorded in plan 2.1. EXECUTION_PLAN.md gains a per-tranche status ledger (1a) that states plainly which tranches are done, domain-only, externally blocked, or not started, and records that this branch and main diverged at b3a9005 with SITE-03 published only on main.	2026-09-26 10:50:33 +00:00
Arena Agent	bbce8fb015	harden SITE-02 repository and native vault contracts	2026-09-13 06:51:39 +00:00
Arena Agent	6d6f887ba6	site: harden SITE-02 process and scope boundaries	2026-09-12 22:11:59 +00:00
Arena Agent	8dbfae8f72	site: add SITE-02 encrypted repository candidate	2026-09-12 21:44:00 +00:00
Arena Agent	5d2d890f70	feat(nigig-site): enforce SITE-01 fail-closed containment ... Contain production capabilities, remove the production sync surface, and keep legacy media/export/transport implementations test-only. Require authenticated existing-key storage with preservation-first recovery and sticky write disablement, backed by deterministic fault and concurrency tests plus dependency and workflow contracts.	2026-09-12 15:46:30 +00:00
andodeki	ac8f8aa002	chore: sync full working tree to gitdab ... Whole-tree sync: cad-core/cad-ui split sources, nigig-build construction_frame migration, pdf port progress, mpesa/pay/uikit/doc updates, workspace members/profiles/lock, CI workflows and reviews. See individual file history for details.	2026-09-12 07:15:24 +03:00